Country Directory

Within each listing, if available, there will be links to the DPA, privacy legislation and relevant resources.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Afghanistan.

Additional resources

• Asia topic page
• Middle East topic page

Data Protection Authority

• Datainspektionen Åland

Privacy Legislation

• DPA Legislation page

Additional resources

• Europe topic page

Data Protection Authority

• Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale ("IDP")

Privacy Legislation

• Law on the Protection of Personal Data No. 9887 of 10 March 2008
• DPA Legislation Page

Additional resources

• Europe topic page

Data Protection Authority

• Autorité Nationale de Protection des Données à caractère Personnel ("ANPDP")

Privacy Legislation

• Law No. 18-07 of 25 Ramadhan 1439 Corresponding to June 10, 2018 Relating to the Protection of Individuals in the Processing of Personal Dat

Additional resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for American Samoa.

Data Protection Authority

• Agència Andorrana de Protecció de Dades ("APDA")

Privacy Legislation

• Law 29/2021, of 28 October, of Personal Data Protection

Additional resources

• Europe topic page

Data Protection Authority

• Agencia de Protecao de Dados ("APD")

Privacy Legislation

• Law No. 22/11 on the Protection of Personal Data
• DPA Legislation Page

Additional resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Anguilla.

Data Protection Authority

• The Information Commissioner

Privacy Legislation

• Data Protection Act (Law No. 10-13)

Data Protection Authority

• Agencia de Acceso a la Información Pública ("AAIP")

Privacy Legislation

• Act No. 25.326 (2000)
• DPA Regulations Page

Additional resources

• Latin America topic page

Data Protection Authority

• Personal Data Protection Agency

Privacy Legislation

• Law No. 49-ZR (2015)

Additional resources

• Europe topic page
• Middle East topic page

Data Protection Authority

• Not yet established.

Privacy Legislation

• The IAPP is unaware of comprehensive data protection legislation for Aruba.

Data Protection Authority

• Office of the Australian Information Commissioner ("OAIC")

Privacy Legislation

• Privacy Act 1988 (Cth) No. 119 1998 and Australian Privacy Principles ("APPs") + sectoral state coverage
• DPA Legislation Page

Additional resources

• Australia/New Zealand topic page

Data Protection Authority

• Österreichische Datenschutzbehörde ("DSB")

Privacy Legislation

• Federal Act concerning the Protection of Personal Data
• Austria is subject to the EU General Data Protection Regulation.
• DPA Legislation Page

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Ministry of Digital Development and Transport

Privacy Legislation

• Law on Personal Information (May 2010)
• Government Legislation Page

Additional resources

• Europe topic page
• Middle East topic page

Data Protection Authority

• Office of the Data Protection Commissioner ("DPC")

Privacy Legislation

• Data Protection (Privacy of Personal Information) Act ("DPA")

Data Protection Authority

• Personal Data Protection Authority

Privacy Legislation

• Law No. 30 of 2018 - Personal Data Protection ("PDPL")

Additional resources

• Middle East topic page

Data Protection Authority

• Digital Security Agency

Privacy Legislation

• None, draft only
• Acts and Rules

Additional resources

• Asia topic page

Data Protection Authority

• Data Protection Commission

Privacy Legislation

• Data Protection Act ("Act")

Data Protection Authority

• National Personal Data Protection Center ("NPDPC")

Privacy Legislation

• Law on Personal Data Protection No. 99-Z (2021)

Additional resources

• Europe topic page

Data Protection Authority

• Data Protection Authority

Privacy Legislation

• Act of 3 December 2017 Establishing the Data Protection Authority, Act of 30 July 2018 on the Protection of Natural Persons with Regard to the Processing of Personal Data
• Belgium is subject to the EU General Data Protection Regulation.
• DPA Publications

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Not yet established.

Privacy Legislation

• Data Protection Act of 2021 ("Act")

Additional resources

• Latin America topic page

Data Protection Authority

• L'Autorité de Protection des Données à caractère Personnel

Privacy Legislation

• Law No. 2009-09 of May 22, 2009 Dealing with the Protection of Personally Identifiable Information (Law No. 2009-09)
• DPA Legislation Page

Additional resources

• Africa topic page

Data Protection Authority

• Office of the Privacy Commissioner for Bermuda ("PrivCom")

Privacy Legislation

• Personal Information Protection Act 2016
• PIPA Overview Page

Data Protection Authority

• Bhutan Information Communication and Media Authority

Privacy Legislation

• ICM Act of Bhutan (2018)
• DPA Legislation Page

Additional resources

• Asia topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Bolivia.

Additional resources

• Latin America topic page

Data Protection Authority

• Commissie toezicht bescherming persoonsgegevens ("CBPBES")

Privacy Legislation

• DPA Legislation Page

Data Protection Authority

• Agencija za zaštitu ličnih podataka u Bosni i Hercegovini ("AZLP")

Privacy Legislation

• Law on the Protection of Personal Data No. 49/06
• DPA Regulations Page

Additional resources

• Europe topic page

Data Protection Authority

• Not yet established, but will be the Information and Data Protection Commission.

Privacy Legislation

• Data Protection Act, 2024 – Act No. 18 of 2024

Additional resources

• Africa topic page

Data Protection Authority

• Autoridade Nacional de Proteção de Dados ("ANPD")

Privacy Legislation

• Brazilian Data Protection Law ("LGPD"), Federal Law no. 13,709/2018
• DPA Legislation Page

Additional resources

• Brazil topic page
• Latin America topic page

Data Protection Authority

• Not yet established.

Privacy Legislation

• Data Protection Act of 2021

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Brunei Darussalam.

Additional resources

• Asia topic page

Data Protection Authority

• Commission for Personal Data Protection ("CPDP")

Privacy Legislation

• The Protection of Personal Data Act 2002
• Bulgaria is subject to the EU General Data Protection Regulation.
• DPA Legislation Page

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Commission de l'Informatique et des Libertes ("CIL")

Privacy Legislation

• Act No. 001-2021/AN of 30 March 2021 ("the 2021 Act")
• DPA Legislation Page

Additional resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Burundi.

Additional resources

• Africa topic page

Data Protection Authority

• Comissão Nacional de Protecção de Dados ("CNPD")

Privacy Legislation

• Law 133-V-2001 on the Protection of Personal Data (as amended by Law No. 41/VIII/2013 - General Legal Regime for the Protection of Personal Data of Individuals (only available in Portuguese here) and Law No. 121/IX/2021 of 17 March 2021
• DPA Legislation Page

Additional resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Cambodia.

Additional resources

• Asia topic page

Data Protection Authority

• The IAPP is unaware of a data protection authority for Cameroon.

Privacy Legislation

• Law No. 2024/017 - Personal Data Protection Act (text unavailable.)

Additional resources

• Africa topic page

Data Protection Authority

• Office of Privacy Commissioner ("OPC")

Privacy Legislation

• Personal Information Protection and Electronic Documents Act 2000 ("PIPEDA")
• DPA Legislation Page

Additional resources

• Canada topic page

Data Protection Authority

• Office of the Ombudsman

Privacy Legislation

• Data Protection Act
• DPA Resources

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Central African Republic.

Additional resources

• Africa topic page

Data Protection Authority

• Agence Nationale de Sécurité Informatique et de Certification Électronique ("ANSICE")

Privacy Legislation

• Law No. 007/PR/2015 on Protection of Personal Data
• DPA Legislation Page

Additional resources

• Africa topic page

Data Protection Authority

• The IAPP is unaware of a data protection authority for Chile.

Privacy Legislation

• Law No. 21.719 (text unavailable.)

Additional resources

• Latin America topic page

Data Protection Authority

• Cyberspace Administration of China

Privacy Legislation

• Personal Information Protection Law, 2021 ("PIPL")

Additional resources

• Asia topic page
• China topic page

Data Protection Authority

• Superintendencia de Industria y Comercio ("SIC")

Privacy Legislation

• Statutory Law 1581 of 2012 ("Personal Data Protection Law")

Additional resources

• Latin America topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Comoros.

Additional resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for the Cook Islands.

Data Protection Authority

• Agencia de Protección de Datos de los Habitantes ("PRODHAB")

Privacy Legislation

• Law No. 8968 (Law on the Protection of Persons Regarding the Processing of their Personal Data)
• DPA Regulations Page

Additional resources

• Latin America topic page

Data Protection Authority

• Autirite de Regulation des Telecomunications de Cote d'Ivoire ("ARTCI")

Privacy Legislation

• Law 20133-450 on the Protection of Personal Data
• DPA Legislation Page

Additional resources

• Africa topic page

Data Protection Authority

• Agencika za zaŝtitu osobnih podataka ("AZOP")

Privacy Legislation

• Law on the Implementation of the General Data Protection Regulation 2018
• Croatia is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Ministerio de Justicia

Privacy Legislation

• Law 149/2022 on Personal Data Protection

Additional resources

• Latin America topic page

Data Protection Authority

• Not yet established.

Privacy Legislation

• Data Protection Ordinance

Additional resources

• Latin America topic page

Data Protection Authority

• Office of the Commissioner for the Protection of Personal Data ("Commissioner")

Privacy Legislation

• Law 125(I) of 2018 Providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of Such Data
• Cyprus is subject to the EU General Data Protection Regulation.
• DPA Legislation Page

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Úřad pro ochranu osobních údajů ("UOOU")

Privacy Legislation

• Act No. 110/2019 Coll. on Personal Data Processing (the Act)
• Czechia is subject to the EU General Data Protection Regulation.
• DPA Legislation Page

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for the Democratic People's Republic of Korea.

Additional resources

• Asia topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for the Democratic Republic of the Congo.

Additional resources

• Africa topic page

Data Protection Authority

• Datatilsynet

Privacy Legislation

• DPA Legislation Page
• Act No. 502 of 23 May 2018 on Supplementary Provisions to the Regulation on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data
• Denmark is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Diego Garcia.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Djibouti.

Additional resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Dominica.

Additional resources

• Latin America topic page

Data Protection Authority

• The IAPP is unaware of a data protection authority for the Dominican Republic.

Privacy Legislation

• Law No. 172-13 on the Comprehensive Protection of Personal Data Contained in Archives, Public Registries, Databases or Other Technical Means of Data Processing Used for Reporting, Whether Public or Private (2013)

Additional resources

• Latin America topic page

Data Protection Authority

• Not yet established, so far it is the National Directorate of Public Records ("DINARP").

Privacy Legislation

• Ley Organica de Proteccion de Datos Personales ("Personal Data Protection Law")

Additional resources

• Latin America topic page

Data Protection Authority

• The IAPP is unaware of a data protection authority for Egypt.

Privacy Legislation

• Law 151/2020 on the Protection of Personal Data

Additional resources

• Africa topic page
• Middle East topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for El Salvador.

Additional resources

• Latin America topic page

Data Protection Authority

• The data protection authority for Equatorial Guinea is not yet established.

Privacy Legislation

• Law No. 1/2016 on the Protection of Personal Data ("the Law") - No available copy yet.

Additional resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Eritrea.

Additional resources

• Africa topic page

Data Protection Authority

• Andmekaitse Inspektsioon ("Data Protection Inspectorate")

Privacy Legislation

• DPA Legislation Page
• Personal Data Protection Act 2018
• Estonia is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Eswatini Communications Commission ("the Commission")

Privacy Legislation

• DPA Legislation Page
• Data Protection Act No. 5 of 2022

Additional resources

• Africa topic page

Data Protection Authority

• Ethiopian Communications Authority

Privacy Legislation

• Personal Data Protection Proclamation No. 1321/2024

Additional resources

• Africa topic page

Privacy Legislation

• Member-states of the European Union are subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Dátueftirlitið

Privacy Legislation

• Act No. 80 of 7 June 2020 on the Protection of Personal Data

Additional resources

• Europe topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Fiji.

Additional resources

• Asia topic page

Data Protection Authority

• Tietosuojavaltuutetun toimisto

Privacy Legislation

• DPA Legislation Page
• Data Protection Act (1050/2018)
• Finland is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Comission nationale de l'informatique et des libertes ("CNIL")

Privacy Legislation

• DPA Official Texts Page
• Act No.78-17 of 6 January 1978 on Data Processing, Data Files and Individual Liberties
• France is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for French Guiana.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for French Polynesia.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for the French Southern Territories.

Data Protection Authority

• L'Autorité pour la Protection des Données Personnelles et de la Vie Privée ("APDPVP")

Privacy Legislation

• Law No. 025/2023 of 09/07/2023 amending Law No. 001/2011 of September 25, 2011, on the protection of personal data

Additional resources

• Africa topic page

Data Protection Authority

• Gambia Public Utilities Regulatory Authority ('PURA')

Privacy Legislation

• The IAPP is unaware of comprehensive data protection legislation for Gambia.

Additional resources

• Africa topic page

Data Protection Authority

• Personal Data Protection Service ("PDPS")

Privacy Legislation

• DPA Legislation Page
• Law Of Georgia on Personal Data Protection of June 14, 2023, No 3144

Additional resources

• Europe topic page
• Middle East topic page

Data Protection Authority

• Die Bundesbeauftragte für den Datenschutz und die Informationsfreiheit ("BfDI")

Privacy Legislation

• Federal Data Protection Act of 30 June 2017
• Germany is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Data Protection Commission ("DPC")

Privacy Legislation

• DPA Legislation Page
• Data Protection Act of 2012

Additional resources

• Africa topic page

Data Protection Authority

• Gibraltar Regulatory Authority

Privacy Legislation

• DPA Legislation Page
• Data Protection Act 2004

Additional resources

• Europe topic page

Data Protection Authority

• Hellenic Data Protection Authority ("HDPA")

Privacy Legislation

• DPA Legislation Page
• Law 4624/2019 on the Personal Data Protection Authority
• Greece is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Datatilsynet (Danish DPA)

Privacy Legislation

• DPA Legislation Page
• Personal Data Protection Act 2016

Additional resources

• Europe topic page

Data Protection Authority

• The data protection authority for Grenada is not yet established.

Privacy Legislation

• Grenada Data Protection Act, No. 1 of 2023 ("GDPA")

Additional resources

• Latin America topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Guadeloupe.

Additional resources

• Latin America topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Guam.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Guatemala.

Additional resources

• Latin America topic page

Data Protection Authority

• The Office of the Data Protection Authority ("ODPA")

Privacy Legislation

• DPA Legislation Page
• The Data Protection Law, 2017 and The Data Protection Ordinance, 2018

Additional resources

• Europe topic page

Data Protection Authority

• The data protection authority for Guinea is not yet established.

Privacy Legislation

• Regulations Page
• Law No. L/2016/037/AN on Cybersecurity and Personal Data Protection

Additional resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Guinea-Bissau.

Additional resources

• Africa topic page

Data Protection Authority

• The IAPP is unaware of a data protection authority for Guyana.

Privacy Legislation

• Data Protection Act No. 18/2023

Additional resources

• Latin America topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Haiti.

Additional resources

• Latin America topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for the Heard Island and McDonald Islands.

Data Protection Authority

• The IAPP is unaware of a data protection authority for Honduras.

Privacy Legislation

• Only Draft Law on the Protection of Personal Data exists (link unavailable.)

Additional resources

• Latin America topic page

Data Protection Authority

• Office of the Privacy Commissioner for Personal Data (PCPD)

Privacy Legislation

• DPA Legislation Page
• Personal Data (Privacy) Ordinance (Cap. 486)

Additional resources

• Asia topic page

Data Protection Authority

• Nemzeti Adatvédelmi és Információszabadság Hatóság ("NAIH")

Privacy Legislation

• Act CXII of 2011 on the Right to Informational Self-determination and on the Freedom of Information, as amended by Act XXXVIII of 2018
• Hungaryis subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Personu Vernd

Privacy Legislation

• DPA Legislation Page
• Act 90/2018 on Privacy and Processing of Personal Data
• Iceland is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• The data protection authority for India is not yet established.

Privacy Legislation

• Digital Personal Data Protection Act, 2023 ("DPDP")

Additional resources

• Asia topic page
• India topic page

Data Protection Authority

• The data protection authority for Indonesia is not yet established.

Privacy Legislation

• Law No. 27 of 2022 regarding Personal Data Protection ("PDPL")

Additional resources

• Asia topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Iran.

Additional resources

• Middle East topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Iraq.

Additional resources

• Middle East topic page

Data Protection Authority

• Data Protection Commission ("DPC")

Privacy Legislation

• DPA Legislation Page
• Data Protection Act 2018
• Ireland is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Barrantagh Fysseree

Privacy Legislation

• Government Data Protection Legislation Page
• Data Protection Act 2018

Additional resources

• Europe topic page

Data Protection Authority

• Privacy Protection Authority ("PPA")

Privacy Legislation

• DPA Legislation Page
• Protection of Privacy Law, 5741-1981 ("Privacy Law")

Additional resources

• Middle East topic page

Data Protection Authority

• Garante per la protezione dei dati personali ("GDPD")

Privacy Legislation

• DPA Legislation Page
• Personal Data Protection Code
• Italy is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Office of the Information Commissioner ("the Commissioner")

Privacy Legislation

• Data Protection Act, 2020

Data Protection Authority

• Personal Information Protection Commission ("PPC")

Privacy Legislation

• DPA Legislation Page
• Act on the Protection of Personal Information, No. 57 of 2003, as amended in 2020 ("APPI")

Additional resources

• Asia topic page

Data Protection Authority

• Jersey Office of the Information Commissioner ("JOIC")

Privacy Legislation

• DPA Legislation Page
• Data Protection Law 2018 and Data Protection Authority Law 2018

Additional resources

• Europe topic page

Data Protection Authority

• Personal Data Protection Unit

Privacy Legislation

• DPA Legislation Page
• Law No. 24 of 2023 Personal Data Protection Law

Additional resources

• Middle East topic page

Data Protection Authority

• Ministry of Digital Development, Innovations and Aerospace ("MDAI")

Privacy Legislation

• Law No. 94-V on Personal Data and its Protection of 21 May 2013

Additional resources

• Asia topic page

Data Protection Authority

• Office of the Data Protection Commissioner ("ODPC")

Privacy Legislation

• Data Protection Act of 2019 and the Data Protection Regulations of 2021

Additional resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Kiribati.

Data Protection Authority

• Agjencia për Informim dhe Privatësi ("AIP")

Privacy Legislation

• DPA Legislation Page
• Law No. 06/L-082 on Personal Data Protection

Additional resources

• Europe topic page

Data Protection Authority

• The IAPP is unaware of a data protection authority for Kuwait.

Privacy Legislation

• DPA Regulations and Decisions

Additional resources

• Middle East topic page

Data Protection Authority

• Personal Data Protection Agency under the Cabinet of Ministers of the Kyrgyz Republic

Privacy Legislation

• DPA Legislation Page
• Law No. 58 on Personal Information of 14 April 2008

Additional resources

• Asia topic page

Data Protection Authority

• Ministry of Post, Telecommunications and Communications ("MTC")

Privacy Legislation

• DPA Legislation Page
• Electronic Data Protection Act 2017

Additional resources

• Asia topic page

Data Protection Authority

• Datu Valsts Inspekcija ("DVI")

Privacy Legislation

• DPA Legislation Page
• Personal Data Processing Law of 21 June 2018
• Latvia is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• None. Data protection law does not require creation of independent public authority.

Privacy Legislation

• Law No. 81 of 10 October 2018 on Electronic Transaction and Personal Data

Additional resources

• Middle East topic page

Data Protection Authority

• The data protection authority for Lesotho is not yet established.

Privacy Legislation

• Data Protection Act of 2011

Additional resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Liberia.

Additional resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Libya.

Additional resources

• Africa topic page

Data Protection Authority

• Datenschutzstelle Fürstentum Liechtenstein

Privacy Legislation

• National Laws Page
• Liechtenstein is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Valstybinė duomenų apsaugos inspekcija

Privacy Legislation

• DPA Legislation Page
• Lithuania is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Commission Nationale Pour La Protection Des Données (CNPD)

Privacy Legislation

• DPA Legislation Page
• Luxembourg is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Personal Data Protection Bureau

Privacy Legislation

• Personal Data Protection Act
• DPA Legislation Page

Additional resources

• Asia topic page
• China topic page

Data Protection Authority

• Commission Malagasy de l’Informatique et des Libertés (CMIL) - Link unavailable.

Privacy Legislation

• Law No. 2014-038 on the Protection of Personal Data

Additional resources

• Africa topic page

Data Protection Authority

• Malawi Communications Regulatory Authority (MACRA)

Privacy Legislation

• DPA Legislation Page
• Data Protection Act, 2024

Additional resources

• Africa topic page

Data Protection Authority

• Jabatan Perlindungan Data Peribadi

Privacy Legislation

• DPA Legislation Page
• Personal Data Protection Act Amendment of 2024

Additional resources

• Asia topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Maldives.

Additional resources

• Asia topic page

Data Protection Authority

• L’autorite de Protection des Donnees a Caractere Personnel (APDP)

Privacy Legislation

• DPA Texts and Decisions
• Law No. 2013-015

Additional resources

• Africa topic page

Data Protection Authority

• Office of the Information and Data Protection Commissioner

Privacy Legislation

• DPA Legislation Page
• Malta is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for the Marshall Islands.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Martinique.

Data Protection Authority

• Personal Data Protection Authority (not yet established.)

Privacy Legislation

• Law No. 2017-020 (link unavailable.)

Additional resources

• Africa topic page

Data Protection Authority

• Data Protection Office

Privacy Legislation

• The Data Protection Act 2017

Additional resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Mayotte.

Additional resources

• Africa topic page

Data Protection Authority

• Instituto Nacional de Transparencia, Acceso a la Informacion y Proteccion de Datos Personales

Privacy Legislation

• DPA Regulations Page
• Federal Law on Protection of Personal Data Held by Private Parties
• General Law on Protection of Personal Data in Possession of Obligated Subjects

Additional resources

• Latin America topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Micronesia.

Data Protection Authority

• Personal Data Protection Authority (APDP) (not yet established.)

Privacy Legislation

• DPA Legislation Page
• Act No. 1.054 on the Protection of Personal Data (link unavailable.)

Additional resources

• Europe topic page

Data Protection Authority

• Ministry of Digital Development and Communications

Privacy Legislation

• DPA Legislation Page
• Law of Mongolia on Protection of Personal Data

Additional resources

• Asia topic page

Data Protection Authority

• Agencija za zaštitu ličnih podataka

Privacy Legislation

• DPA Regulations Page
• Personal Data Protection Law 79/08 and 70/09

Additional resources

• Europe topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Montserrat.

Data Protection Authority

• Commission Nationale de Contrôle de la Protection des Données à caractère Personnel (CNDP)

Privacy Legislation

• Law No. 09-08

Additional resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Mozambique.

Additional resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Myanmar.

Additional resources

• Asia topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Namibia.

Additional resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Nauru.

Data Protection Authority

• The IAPP is unaware of a data protection authority for Nepal.

Privacy Legislation

• The Privacy Act, 2075 (2018)

Additional resources

• Asia topic page

Data Protection Authority

• Autoriteit Persoonsgegevens

Privacy Legislation

• The Netherlands is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for New Caledonia.

Data Protection Authority

• Office of the Privacy Commissioner of New Zealand (OPC)

Privacy Legislation

• Privacy Act 2020

Additional resources

• Australia/New Zealand topic page

Data Protection Authority

• Nicaraguan data protection authority (DIPRODAP) - Not yet established.

Privacy Legislation

• Law on Personal Data Protection No. 787

Additional resources

• Latin America topic page

Data Protection Authority

• La Haute Autorité de Protection des Données à caractère Personnel (HAPDP)

Privacy Legislation

• DPA Legislation Page
• Law No. 2017-28 of 3 May 2017 on the Protection of Personal Data

Additional resources

• Africa topic page

Data Protection Authority

• Nigeria Data Protection Commission

Privacy Legislation

• DPA Legislation and Resources Page
• Nigeria Data Protection Act

Additional resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Niue.

Data Protection Authority

• Personal Data Protection Agency

Privacy Legislation

• DPA Legislation Page
• Law on Personal Data Protection 2020

Additional resources

• Europe topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for the Northern Mariana Islands.

Data Protection Authority

• Datatilsynet

Privacy Legislation

• DPA Regulations Page
• Norway is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Ministry of Transport, Communications and Information Technology

Privacy Legislation

• DPA Legislation Page
• Royal Decree No. 6 of 2022 Promulgating the Personal Data Protection Law

Additional resources

• Middle East topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Pakistan.

Additional resources

• Asia topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Palau.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for the Palestinian Territories.

Additional resources

• Middle East topic page

Data Protection Authority

• Autoridad Nacional de Transparencia y Acceso a la Información (ANTAI)

Privacy Legislation

• DPA Legislation Page
• Law No. 81 on Personal Data Protection 2019

Additional resources

• Latin America topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Papua New Guinea.

Additional resources

• Australia/New Zealand topic page

Data Protection Authority

• The IAPP is unaware of a data protection authority for Paraguay.

Privacy Legislation

• Law No. 1682 Regulates Private Information 2001

Additional resources

• Latin America topic page

Data Protection Authority

• Autoridad Nacional de Protección de Datos Personales (ANDP)

Privacy Legislation

• DPA Legislation Page
• Reglamento de la Ley N° 29733, Ley de Protección de Datos Personales; Decreto Supremo N° 016-2024-JUS (link unavailable.)

Additional resources

• Latin America topic page

Data Protection Authority

• National Privacy Commission

Privacy Legislation

• Data Privacy Act

Additional resources

• Asia topic page

Data Protection Authority

• Urzad Ochrony Danych Osobowych

Privacy Legislation

• DPA Legislation Page
• Poland is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Comissão Nacional de Proteção de Dados

Privacy Legislation

• Portugal is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Departamento de Asuntos del Consumidor (DACO)

Privacy Legislation

• The IAPP is unaware of comprehensive data protection legislation for Puerto Rico.

Data Protection Authority

• National Cyber Governance and Assurance Affairs

Privacy Legislation

• DPA Legislation Page
• Law No. (13) of 2016 Concerning Personal Data Protection

Additional resources

• Middle East topic page

Data Protection Authority

• Personal Information Protection Commission (PIPC)

Privacy Legislation

• DPA Legislation Page
• Personal Information Protection Act (2011) ("PIPA")

Additional resources

• Asia topic page

Data Protection Authority

• Centrul Naţional pentru Protecţia Datelor cu Caracter Personal al Republica Moldova (CNPDCP)

Privacy Legislation

• DPA Legislation Page
• Law No. 195 of 25-07-2024 regarding the protection of personal data

Additional resources

• Europe topic page

Data Protection Authority

• The data protection authority for Republic of the Congo is not yet established.

Privacy Legislation

• Law 29-2019 on the Protection of Personal Data

Additional resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Réunion.

Data Protection Authority

• Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal

Privacy Legislation

• DPA Legislation Page
• Romania is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Roskomnadzor

Privacy Legislation

• Federal Law of 27 July 2006 No. 152-FZ on Personal Data

Additional resources

• Asia topic page
• Europe topic page
• Russia topic page

Data Protection Authority

• Data Protection Office

Privacy Legislation

• Law No 058/2021 - Protection of Personal Data and Privacy Law

Additional resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Saint Barthélemy.

Data Protection Authority

• Information Commissioner (not yet established.)

Privacy Legislation

• Data Protection Act 2018 (not yet in force.)

Data Protection Authority

• Data Protection Commissioner (link unavailable.)

Privacy Legislation

• Privacy and Data Protection Act

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Saint Martin.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Saint Pierre and Miquelon.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Saint Vincent and the Grenadines.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Samoa.

Data Protection Authority

• Autorità Garante per la Protezione dei Dati Personali

Privacy Legislation

• DPA Legislation Page
• Law No. 171 of 21 December 2018, Protection of Natural Persons with Regard to the Processing of Personal Data

Additional resources

• Europe topic page

Data Protection Authority

• Agência Nacional de Protecção de Dados Pessoais (ANPDP)

Privacy Legislation

• DPA Legislation Page
• Law No. 03/2016

Additional resources

• Africa topic page

Data Protection Authority

• Saudi Data & Artificial Intelligence Authority

Privacy Legislation

• DPA Legislation Page
• Personal Data Protection Law

Additional resources

• Middle East topic page

Data Protection Authority

• Commission de Protection de Donnees Personelles (CDP)

Privacy Legislation

• DPA Legislation Page
• Law No 2008-12

Additional resources

• Africa topic page

Data Protection Authority

• Commissioner for Information of Public Importance and Personal Data Protection (Poverenik)

Privacy Legislation

• Law on Protection of Personal Data
• DPA Legislation Page

Additional resources

• Europe topic page

Data Protection Authority

• Information Commission of Seychelles

Privacy Legislation

• Data Protection Act, 2023

Additional resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Sierra Leone.

Additional resources

• Africa topic page

Data Protection Authority

• Personal Data Protection Commission

Privacy Legislation

• DPA Legislation Page
• Personal Data Protection Act 2012 (No. 26 of 2012)

Additional resources

• Asia topic page

Data Protection Authority

• Personal Data Protection Supervisory Committee (link unavailable.)

Privacy Legislation

• National Ordinance for the Protection of Personal Data

Data Protection Authority

• Úrad na ochranu osobných údajov Slovenskej republiky

Privacy Legislation

• DPA Legislation Page
• Slovakia is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Úrad na ochranu osobných údajov Slovenskej republiky

Privacy Legislation

• DPA Legislation Page
• Slovenia is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for the Solomon Islands.

Data Protection Authority

• Somali Data Protection Authority (DPA)

Privacy Legislation

• Law No. 005 of 2023 Data Protection Act

Additional resources

• Africa topic page

Data Protection Authority

• Information Regulator

Privacy Legislation

• The Protection of Personal Information Act, (Act 4 of 2013)

Additional resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for South Georgia and the South Sandwich Islands.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for South Sudan.

Additional resources

• Africa topic page

Data Protection Authority

• Agencia Española de Protección de Datos (AEPD)

Privacy Legislation

• DPA Legislation Page
• Spain is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• The Data Protection Authority of Sri Lanka

Privacy Legislation

• Personal Data Protection Act No. 9 of 2022

Additional resources

• Asia topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Sudan.

Additional resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Suriname.

Additional resources

• Latin America topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Svalbard and Jan Mayen.

Data Protection Authority

• Integritetsskyddsmyndigheten (IMY)

Privacy Legislation

• Sweden is subject to the EU General Data Protection Regulation.

Additional resources

• Europe topic page
• GDPR topic page

Data Protection Authority

• Préposé fédéral à la protection des données et à la transparence (PFPDT)

Privacy Legislation

• DPA Legislation Page
• Ordinance on the Federal Act on Data Protection

Additional resources

• Europe topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for the Syrian Arab Republic.

Additional resources

• Middle East topic page

Data Protection Authority

• Regulator - National Development Council

Privacy Legislation

• Personal Data Protection Act

Additional resources

• Asia topic page
• China topic page

Data Protection Authority

• Communication Service under the Government of the Republic of Tajikistan

Privacy Legislation

• Law of 3 August 2018 No.1537 on Protection of Personal Data

Additional resources

• Asia topic page

Data Protection Authority

• Personal Data Protection Committee

Privacy Legislation

• DPA Legislation Page
• Personal Data Protection Act 2019

Additional resources

• Asia topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Timor-Leste.

Additional resources

• Asia topic page

Data Protection Authority

• Instance de Protection des Données à Caractère Personnel (link unavailable.)

Privacy Legislation

• Law No. 2019-014

Additional resources

• Africa topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Tonga.

Data Protection Authority

• Office of the Information Commissioner (not yet established.)

Privacy Legislation

• Data Protection Act, 2011

Additional resources

• Latin America topic page

Data Protection Authority

• Instance Nationale De Protection Des Données Personnelles (INPDP)

Privacy Legislation

• DPA Legislation Page
• Organic Act No. 2004-63

Additional resources

• Africa topic page

Data Protection Authority

• Kişisel Verileri Koruma Kurumu

Privacy Legislation

• Law on Protection of Personal Data No. 6698

Additional resources

• Asia topic page
• Europe topic page
• Middle East topic page

Data Protection Authority

• Regulator - The Cabinet of Ministers of Turkmenistan

Privacy Legislation

• Law of Turkmenistan No.519-V ‘On Information about Private Life and its Protection’ (the ‘Data Protection Law’)

Additional resources

• Asia topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Turks and Caicos Islands.

Data Protection Authority

• Personal Data Protection Office

Privacy Legislation

• Data Protection and Privacy Act 2019

Additional resources

• Africa topic page

Data Protection Authority

• The Ukraine Parliamentary Commissioner for Human Rights

Privacy Legislation

• Personal Data Protection Law

Additional resources

• Europe topic page

Data Protection Authority

• UAE Data Office (not yet established.)

Privacy Legislation

• Government Privacy Legislation Page
• Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data

Additional resources

• Middle East topic page

Data Protection Authority

• Information Commissioner's Office

Privacy Legislation

• Data Protection Act 2018
• UK GDPR
• ICO's UK GDPR guidance and resources

Additional resources

• Europe topic page
• United Kingdom topic page

Data Protection Authority

• UTANGULIZI TUME YA ULINZI WA TAARIFA BINAFSI

Privacy Legislation

• The Personal Data Protection Act, 2022

Additional resources

• Africa topic page

Data Protection Authority

• Federal Trade Commission

Privacy Legislation

• No general federal privacy regulation, although there are many sectoral laws.
• US Federal Privacy Legislation Tracker
• US State Privacy Legislation Tracker

Additional resources

• US Federal Privacy topic page
• US State Privacy topic page

Data Protection Authority

• Unidad Reguladora y de Control de Datos Personales

Privacy Legislation

• Law No. 18.331 on the Protection of Personal Data and the Habeas Data Action 2008

Additional resources

• Latin America topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for the US Virgin Islands.

Data Protection Authority

• State Personalisation Centre of Uzbekistan

Privacy Legislation

• Law of Uzbekistan of 2 July 2019 No. ЗРУ-547 on Personal Data

Additional resources

• Asia topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Vanuatu.

Data Protection Authority

• The Pontifical Commission

Privacy Legislation

• Regolamento Generale sulla protezione dei Dati personali

Additional resources

• Europe topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Venezuela.

Additional resources

• Latin America topic page

Data Protection Authority

• Ministry of Public Security

Privacy Legislation

• Law on Personal Data Protection (PDPL) - Text unavailable.

Additional resources

• Asia topic page

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for Wallis and Futuna.

Data Protection Authority and Privacy Legislation

• The IAPP is unaware of a data protection authority or comprehensive data protection legislation for the Western Sahara.

Additional resources

• Africa topic page

Data Protection Authority

• The IAPP is unaware of a data protection authority for Yemen.

Privacy Legislation

• Law No. (13) of 2012 regarding the right to information

Additional resources

• Africa topic page

Data Protection Authority

• Office of the Data Protection Commissioner

Privacy Legislation

• The Data Protection Act, 2021

Additional resources

• Africa topic page

Data Protection Authority

• Postal and Telecommunications Regulatory Authority of Zimbabwe

Privacy Legislation

• DPA Legislation Page
• Data Protection Act 5 of 2021

Additional resources

• Africa topic page